feat: Add the vantagectl restore and verify subcommands

--force requires a typed database name on a terminal and --confirm-db
without one, so a copy-pasted restore command carries its intended target
and cannot destroy a different database.

Also silences cobra's own error print (root.go) so a failure is reported
once by main.go instead of twice, and pins the Changed()-based env
fallback in resolveGlobals with a test for an explicitly empty --db.

internal/cmd/root.go

@@ -39,7 +39,8 @@ func NewRoot(version string) *cobra.Command {
 			"KEY_ENCRYPTION_KEY is never written into an archive. What an archive\n" +
 			"records is a fingerprint of it, so a restore can tell you that the key\n" +
 			"you hold is the wrong one before it writes a database nobody can read.",
-		SilenceUsage: true,
+		SilenceUsage:  true,
+		SilenceErrors: true,
 	}
 
 	f := root.PersistentFlags()